On October 22, 2026, two critical security vulnerabilities in PHP were revealed, affecting around 70% of websites. The PHP Foundation and developers raced to implement a patch after the flaws were leaked before a formal announcement. Ondřej Surý, a volunteer maintainer, was instrumental in automating the patch process. He emphasized the need for better support for open-source contributors and expressed optimism for the future of cybersecurity, despite the challenges posed by rapid technological changes.
Key facts
- Two security vulnerabilities in PHP were discovered on October 22, 2026.
- PHP is used by approximately 70% of websites.
- Matthew Prince reported thousands of exploitation attempts before the public announcement.
- Ondřej Surý is a volunteer maintainer of PHP and works at the Internet Systems Consortium.
- Surý emphasized the need for better support for open-source contributors.
A short AI summary in our own words. The reporting belongs to The Atlantic; we don't reproduce it.